registry / @miravia_skills/miravia-order-report / 0.1.38

@miravia_skills/miravia-order-report@0.1.38

Miravia Order Report Skill installer — one command to install the Miravia order export & analytics skill into any AI Agent (Qoder / Cursor / Claude Code).

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

MinifiedTelemetry

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 239 KB of source

Source & flagged code

7 flagged

dist/scripts/skill_keypair.pyView file

Lines 1-87python

1#!/usr/bin/env python3

2# -*- coding: utf-8 -*-

3"""

4Skill keypair management (consumer side only)

6The private key is generated by the backend during Skill registration;

7the seller persists it to .keypair.json during initialization.

8This module only reads and normalizes the format (raw Base64 -> PEM).

10File location: <skill_dir>/.keypair.json

11File format (example):

12{

13 "skill_code": "<32-char skillCode>",

14 "private_key": "-----BEGIN PRIVATE KEY-----\\n...\\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/skill_keypair.pyView on unpkg · L14

Critical

Secret Pattern

RSA private key in dist/scripts/skill_keypair.py

dist/scripts/skill_keypair.pyView on unpkg · L14

15 "sign_method": "SHA256withRSA"

16}

18private_key can also be raw Base64 (PKCS#8 single-line); this module auto-wraps it into PEM.

19"""

21from __future__ import annotations

23import json

24import os

25import textwrap

26from typing import Dict

28import config

31class SkillKeypairError(RuntimeError):

32 pass

35def _to_pem(private_key_str: str) -> bytes:

36 """Normalize a private key string into PEM bytes.

38 Supports two input formats:

39 - Already PEM text (with -----BEGIN/-----END headers);

40 - Raw Base64 PKCS#8 single-line (no headers), auto-wrapped into PEM.

41 """

42 s = private_key_str.strip()

43 if not s:

44 raise SkillKeypairError("private_key is empty")

45 if "BEGIN" in s and "END" in s:

46 # Already PEM; normalize line endings

47 return s.replace("\r\n", "\n").encode("utf-8")

48 # Raw Base64 -> wrap as PEM; fold at 64 chars

49 body = "\n".join(textwrap.wrap(s, 64))

50 pem = f"-----BEGIN PRIVATE KEY-----\n{body}\n-----END PRIVATE KEY-----\n"

Critical

Secret Pattern

RSA private key in dist/scripts/skill_keypair.py

dist/scripts/skill_keypair.pyView on unpkg · L50

51 return pem.encode("utf-8")

54def load_keypair(path: str = None) -> Dict:

55 """Read .keypair.json and return a dict.

57 Returned fields:

58 - skill_code: str

59 - private_key_pem: bytes (PEM format, can be fed directly to cryptography.serialization.load_pem_private_key)

60 - sign_method: str (default SHA256withRSA)

61 """

62 path = path or config.KEYPAIR_FILE

63 if not os.path.exists(path):

64 raise SkillKeypairError(

65 f".keypair.json not found: {path}\n"

66 f"Please persist the Skill-registered private key and skillCode to this file.\n"

67 f"Template: {{\"skill_code\":\"...\",\"private_key\":\"-----BEGIN PRIVATE KEY-----...\",\"sign_method\":\"SHA256withRSA\"}}"

Critical

Secret Pattern

RSA private key in dist/scripts/skill_keypair.py

dist/scripts/skill_keypair.pyView on unpkg · L67

68 )

69 try:

70 with open(path, "r", encoding="utf-8") as f:

71 raw = json.load(f)

72 except json.JSONDecodeError as e:

73 raise SkillKeypairError(f".keypair.json parse failed: {e}") from e

75 skill_code = (raw.get("skill_code") or "").strip()

76 private_key = raw.get("private_key") or ""

77 if not skill_code:

78 raise SkillKeypairError(".keypair.json missing skill_code")

79 if not private_key:

80 raise SkillKeypairError(".keypair.json missing private_key")

82 return {

83 "skill_code": skill_code,

84 "private_key_pem": _to_pem(private_key),

85 "sign_method": (raw.get("sign_method") or "SHA256withRSA").strip(),

86 }

dist/scripts/export_orders.pyView file

•path = dist/scripts/export_orders.py kind = build_helper sizeBytes = 73597 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/export_orders.pyView on unpkg

bin/cli.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = miravia-order-report@0.1.13 matchedPath = bin/cli.js matchedIdentity = npm:bWlyYXZpYS1vcmRlci1yZXBvcnQ:0.1.13 similarity = 0.833 shingleOverlap = 5 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

bin/cli.jsView on unpkg

dist/README.mdView file

Lines 60-100markdown

61Authorization flow:

63```mermaid

64graph LR

65 A[auth_cli login] --> B[Local callback :8765]

66 A --> C[Browser opens auth page]

67 C --> D[Seller approves]

68 D --> E[Frontend POST /skill/auth]

69 E --> F[Backend RSA-encrypts cipher]

70 F --> B

71 B --> G[CLI decrypts with private key -> credentials.json]

72```

Source & flagged code

7 flagged · loading source

dist/scripts/skill_keypair.pyView file

14patternName = private_key_rsa severity = critical line = 14 matchedText = "private...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/skill_keypair.pyView on unpkg · L14

14patternName = private_key_rsa severity = critical line = 14 matchedText = "private...--",

Critical

Secret Pattern

RSA private key in dist/scripts/skill_keypair.py

dist/scripts/skill_keypair.pyView on unpkg · L14

50patternName = private_key_rsa severity = critical line = 50 matchedText = pem = f"...-\n"

Critical

Secret Pattern

RSA private key in dist/scripts/skill_keypair.py

dist/scripts/skill_keypair.pyView on unpkg · L50

67patternName = private_key_rsa severity = critical line = 67 matchedText = f"Templa..."}}"

Critical

Secret Pattern

RSA private key in dist/scripts/skill_keypair.py

dist/scripts/skill_keypair.pyView on unpkg · L67

dist/scripts/export_orders.pyView file

•path = dist/scripts/export_orders.py kind = build_helper sizeBytes = 73597 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/export_orders.pyView on unpkg

bin/cli.jsView file

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

bin/cli.jsView on unpkg

dist/README.mdView file

80patternName = private_key_rsa severity = critical line = 80 matchedText = # "pri...--",

Critical

Secret Pattern

RSA private key in dist/README.md

dist/README.mdView on unpkg · L80

Findings

5 Critical1 High3 Medium4 Low

CriticalCritical Secretdist/scripts/skill_keypair.py

CriticalSecret Patterndist/README.md

CriticalSecret Patterndist/scripts/skill_keypair.py

HighPackage Source Clone Identity Mismatchbin/cli.js

MediumEnvironment Vars

MediumShips Build Helperdist/scripts/export_orders.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowTelemetry

Source & flagged code

7 flagged

dist/scripts/skill_keypair.pyView file

Lines 1-87python

1#!/usr/bin/env python3

2# -*- coding: utf-8 -*-

3"""

4Skill keypair management (consumer side only)

6The private key is generated by the backend during Skill registration;

7the seller persists it to .keypair.json during initialization.

8This module only reads and normalizes the format (raw Base64 -> PEM).

10File location: <skill_dir>/.keypair.json

11File format (example):

12{

13 "skill_code": "<32-char skillCode>",

14 "private_key": "-----BEGIN PRIVATE KEY-----\\n...\\n-----END PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/scripts/skill_keypair.pyView on unpkg · L14

Critical

Secret Pattern

RSA private key in dist/scripts/skill_keypair.py

dist/scripts/skill_keypair.pyView on unpkg · L14

15 "sign_method": "SHA256withRSA"

16}

18private_key can also be raw Base64 (PKCS#8 single-line); this module auto-wraps it into PEM.

19"""

21from __future__ import annotations

23import json

24import os

25import textwrap

26from typing import Dict

28import config

31class SkillKeypairError(RuntimeError):

32 pass

35def _to_pem(private_key_str: str) -> bytes:

36 """Normalize a private key string into PEM bytes.

38 Supports two input formats:

39 - Already PEM text (with -----BEGIN/-----END headers);

40 - Raw Base64 PKCS#8 single-line (no headers), auto-wrapped into PEM.

41 """

42 s = private_key_str.strip()

43 if not s:

44 raise SkillKeypairError("private_key is empty")

45 if "BEGIN" in s and "END" in s:

46 # Already PEM; normalize line endings

47 return s.replace("\r\n", "\n").encode("utf-8")

48 # Raw Base64 -> wrap as PEM; fold at 64 chars

49 body = "\n".join(textwrap.wrap(s, 64))

50 pem = f"-----BEGIN PRIVATE KEY-----\n{body}\n-----END PRIVATE KEY-----\n"

Critical

Secret Pattern

RSA private key in dist/scripts/skill_keypair.py

dist/scripts/skill_keypair.pyView on unpkg · L50

51 return pem.encode("utf-8")

54def load_keypair(path: str = None) -> Dict:

55 """Read .keypair.json and return a dict.

57 Returned fields:

58 - skill_code: str

59 - private_key_pem: bytes (PEM format, can be fed directly to cryptography.serialization.load_pem_private_key)

60 - sign_method: str (default SHA256withRSA)

61 """

62 path = path or config.KEYPAIR_FILE

63 if not os.path.exists(path):

64 raise SkillKeypairError(

65 f".keypair.json not found: {path}\n"

66 f"Please persist the Skill-registered private key and skillCode to this file.\n"

67 f"Template: {{\"skill_code\":\"...\",\"private_key\":\"-----BEGIN PRIVATE KEY-----...\",\"sign_method\":\"SHA256withRSA\"}}"

Critical

Secret Pattern

RSA private key in dist/scripts/skill_keypair.py

dist/scripts/skill_keypair.pyView on unpkg · L67

68 )

69 try:

70 with open(path, "r", encoding="utf-8") as f:

71 raw = json.load(f)

72 except json.JSONDecodeError as e:

73 raise SkillKeypairError(f".keypair.json parse failed: {e}") from e

75 skill_code = (raw.get("skill_code") or "").strip()

76 private_key = raw.get("private_key") or ""

77 if not skill_code:

78 raise SkillKeypairError(".keypair.json missing skill_code")

79 if not private_key:

80 raise SkillKeypairError(".keypair.json missing private_key")

82 return {

83 "skill_code": skill_code,

84 "private_key_pem": _to_pem(private_key),

85 "sign_method": (raw.get("sign_method") or "SHA256withRSA").strip(),

86 }

dist/scripts/export_orders.pyView file

•path = dist/scripts/export_orders.py kind = build_helper sizeBytes = 73597 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/export_orders.pyView on unpkg

bin/cli.jsView file

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

bin/cli.jsView on unpkg

dist/README.mdView file

Lines 60-100markdown

61Authorization flow:

63```mermaid

64graph LR

65 A[auth_cli login] --> B[Local callback :8765]

66 A --> C[Browser opens auth page]

67 C --> D[Seller approves]

68 D --> E[Frontend POST /skill/auth]

69 E --> F[Backend RSA-encrypts cipher]

70 F --> B

71 B --> G[CLI decrypts with private key -> credentials.json]

72```